Privacy Policy
NovaByte Lab, India ("we") provides SyncStudio, an add-on for Google Sheets and for Microsoft Excel that brings data from your databases and business applications into your spreadsheets. This policy explains what we collect, why, and what we do not collect.
Contact: support@novabytelab.in
1. The short version
- The rows that come from your data sources, and the contents of your spreadsheet cells, pass through our servers while an import runs and are not stored by us and not written to our logs.
- We store what is needed to run your imports on a schedule: your account, your import definitions, and encrypted credentials for the sources you connect.
- In the Excel add-in, the rows travel through our servers to your own copy of Excel, which writes them into the workbook. They are not stored by us on the way.
- If an administrator of your team switches on AI drafts, the names of your tables and columns, and what you type in the request, are sent to Google's Gemini models to write a draft query. Rows are never sent.
- We do not sell personal data, and we do not use your data for advertising.
2. What we collect and store
| Data | Why | How long |
|---|---|---|
| Your email address and Google account identifier | To sign you in and place you in your organization | Until your account is deleted |
| If you use the Excel add-in: your Microsoft account's tenant and account identifiers, and your sign-in name | To sign you in and place you in your organization | Until your account is deleted |
| A Google authorisation token (a "refresh token"), encrypted | To write to your spreadsheets when a scheduled import runs while you are away. If you choose "Connect with Google" for BigQuery, Google Analytics or Search Console, the same token lets us read that source with your own read-only access, to run the imports you save | Until you disconnect or delete your account |
| Credentials you give us for other sources (database passwords, API keys), encrypted | To read from that source on your schedule | Until you delete the connection |
| Connection settings that are not secret (host names, database names, project IDs) | To reach the source | Until you delete the connection |
| Import definitions: name, the query or the table, columns and filters chosen, destination spreadsheet ID and tab name, schedule; the descriptions you write for an import and its columns; column names, renames and conversions | To run the import and label the data in your spreadsheet | Until your account is deleted. An import you delete is removed from our database within 30 days |
| Run history: time, status, number of rows, bytes billed by BigQuery, and error messages | To show you what happened and to troubleshoot. Error messages returned by a data source can contain fragments of your query | 90 days |
| Where each alert is sent: email addresses, or the address of a Slack or Google Chat webhook, encrypted | To deliver the alerts you set up | Until you delete the alert |
| A list of the snapshot tabs an import has created (the tab's identifier and name) | So that only those tabs are ever removed when old snapshots are tidied away | Until the snapshot is removed or the import is deleted |
| Keys for AI assistants and links for connecting a source: a one-way fingerprint of each, never the key or link itself | To recognise a key or link when it is used | Until the key is removed; links for 30 days after they expire |
| If AI drafts are switched on: what you asked for and the draft that was returned; and how much of the AI allowance each request used | To troubleshoot, and to count usage against your plan | Requests and drafts: 30 days. Usage counts: while you have an account |
| Write-back settings (which tab, which table, which key column) and a record of each commit: who, when, how many rows, which columns | To run the write-back and show what was done | Until you delete the write-back or your account |
| An activity record of actions taken through an AI assistant, a connection link or a write-back: who, what kind of action, and which import, connection or table | Accountability | 400 days |
| Subscription status, and a record of each payment event from our payment provider: identifiers, amount, currency and status | To apply your plan and match each payment to your organization | While you have an account, and afterwards as tax law requires |
| Team invitations: the invited email address and role | To let an invited person join your organization | Until accepted or revoked |
Credentials are encrypted before they are stored, each bound to the record it belongs to, and are never returned by our service or shown again in the product.
3. What we do not collect or store
- The rows returned by your queries and data sources.
- The contents of your spreadsheets.
- The values a write-back writes to your database, or the values it replaces.
- The text of alert messages after they are sent.
- Payment card details. Our payment provider handles those; we never receive them.
This website sets no cookies and uses no analytics or tracking. Like any web server, the service keeps a log of requests (time, address requested, status and the sender's IP address) for security and troubleshooting.
4. Information from Google
SyncStudio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We request these Google permissions:
| Permission | What it lets us do | What we use it for |
|---|---|---|
| See your primary Google Account email address | Know who you are | Sign-in |
| See, edit, create and delete your Google Sheets spreadsheets | Read and write spreadsheets you can edit | Only for these, each in a tab where you created an import or a write-back: to write import results; to read the cells you point a filter or an alert at; to read the header and key columns; to copy the formulas you keep beside an import down to new rows; to add notes to the header row; to make and remove snapshot copies of the tab when you switch snapshots on; to read the tab when you ask for a write-back review; and to read an import's rows when an AI assistant you connected with your own key asks for them. We do not open any spreadsheet in which you have not created an import, except one whose link you give us as a source to import from, which we only read |
| View your data in Google BigQuery (only if you choose "Connect with Google") | Read BigQuery data you can read | Only to run the queries you save, list the tables you can choose from, and estimate a query's cost |
| See and download your Google Analytics data (only if you connect Google Analytics) | Read the reports and property list you can see | Only to list your properties and their columns, and to run the reports you save |
| View Search Console data for your verified sites (only if you connect Search Console) | Read search performance for sites you can see | Only to list your sites and to run the reports you save |
AI features and Google data. If your team's administrator switches on AI drafts and you ask for a draft on a Google source, the names and types of that source's tables and columns are sent to Google's Gemini models, running in Google Cloud, to write it. Rows and cell contents are not. If you connect an AI assistant with a key, the rows of the imports you ask it for are read from your spreadsheet and returned to that assistant, at your request.
We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. We do not transfer Google user data to others except as needed to provide the features you use, to comply with law, or as part of a merger or acquisition with notice to you. No human at NovaByte Lab reads your Google data unless you ask us to for support, it is necessary for security purposes, or the law requires it.
5. Who processes data for us
| Company | Role | Data involved |
|---|---|---|
| Google Cloud | Hosts the service. Also runs the Gemini models that write AI drafts, only if an administrator of your team switches AI drafts on | Everything in section 2; your source data in memory while an import runs. For AI drafts: what you typed in the request, and the names and types of tables and columns. Never rows |
| Neon | Hosts our database | Everything in section 2 (credentials in encrypted form) |
| Dodo Payments | Sells subscriptions as merchant of record | Your email address, what you bought, and your payment details |
The sources you connect (for example Stripe or your own database) are your own providers. We read from them with the credentials you supply. The same is true of the places you choose to send alerts (a Slack or Google Chat webhook), the AI assistant you connect with a key, and the database a write-back writes to: we send them what you set up, and what they do with it is governed by your agreement with them.
If you use the Excel add-in, Microsoft signs you in. We receive a signed statement of who you are from Microsoft and send Microsoft nothing.
6. Where data is processed
The service and its database run in the United States. If you are elsewhere, using SyncStudio means your data in section 2 is transferred to and processed in the United States.
7. Your choices and rights
- Disconnect Google or delete any connection at any time, in the add-on or by contacting us; the stored credential is deleted.
- Delete your account by writing to support@novabytelab.in. We delete your organization's data within 30 days, except records we must keep by law (for example records of payments).
- Revoke Google access at any time at myaccount.google.com/permissions.
- Remove an AI assistant's key at any time in Settings; it stops working at once. An administrator can switch assistants, or AI drafts, off for the whole team.
- Depending on where you live, you may have rights to access, correct, export or erase your personal data, and to object to or restrict its processing. Contact us to use them. You may also complain to your data protection authority.
8. Security
Credentials are encrypted. The component that runs imports is not reachable from the internet. Every request is checked against your organization, so one organization cannot read another's data. Connections we make to hosts you specify are blocked from reaching private or internal network addresses. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay. The security page says more, including what has not been done yet.
9. Children
SyncStudio is a business tool and is not directed at children under 16.
10. Changes
We will post changes here and, for significant changes, notify account administrators by email before they take effect.